Generally, Internet Behavioral Analytics (IBA) refers to the use of advanced analytics coupled with various networking technologies, to detect anomalies in a network. Such anomalies may include, for example, network attacks, malware, misbehaving and misconfigured devices, and the like. For example, the ability to model the behavior of a device (e.g., a host, networking switch, router, etc.) allows for the detection of malware, which is complimentary to the use of firewalls that use static signatures for detection. Observing behavioral changes (e.g., deviations from a modeled behavior) using flows records, deep packet inspection, and the like, allows for the detection of an anomaly such as a horizontal movement (e.g. propagation of malware in the network) or an attempt to perform information exfiltration, prompting the system to take remediation actions, automatically.